chore: sync workflow templates by stranske · Pull Request #147 · stranske/Manager-Database

stranske · 2026-01-05T06:59:06Z

Sync Summary

Files Updated

keepalive_instruction_template.js: Generates keepalive instructions for Codex
keepalive_loop.js: Core keepalive loop logic
keepalive_prompt_routing.js: Prompt routing logic for keepalive - determines which prompt template to use
error_classifier.js: Classifies CI errors for agent handling
agents-guard.js: Guards against unauthorized agent workflow file changes

Files Skipped

pr-00-gate.yml: File exists and sync_mode is create_only
ci.yml: File exists and sync_mode is create_only
dependabot.yml: File exists and sync_mode is create_only

Review Checklist

CI passes with updated workflows
No repo-specific customizations were overwritten

Source: stranske/Workflows
Manifest: .github/sync-manifest.yml

Automated sync from stranske/Workflows Template hash: 69bf45f7ea5a Changes synced from sync-manifest.yml

github-actions · 2026-01-05T06:59:18Z

⚠️ Action Required: Unable to determine source issue for PR #147. The PR title, branch name, or body must contain the issue number (e.g. #123, branch: issue-123, or the hidden marker ).

github-actions · 2026-01-05T06:59:34Z

🤖 Keepalive Loop Status

PR #147 | Agent: Codex | Iteration 0/5

Current State

Metric	Value
Iteration progress	[----------] 0/5
Action	wait (missing-agent-label)
Disposition	skipped (transient)
Gate	success
Tasks	0/8 complete
Keepalive	❌ disabled
Autofix	❌ disabled

🔍 Failure Classification

github-actions · 2026-01-05T06:59:42Z

Copilot

Pull request overview

This PR syncs workflow template files from the central Workflows repository, introducing a new prompt routing system for keepalive workflows and enhancing error classification for transient failures.

Key Changes:

Adds prompt routing logic to dynamically select instruction templates based on scenario (fix CI, verify acceptance, or normal task progression)
Implements task attempt tracking to avoid repeatedly trying the same incomplete tasks
Enhances transient error detection for dirty git state issues (workflow artifacts, untracked session files)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`.github/scripts/keepalive_prompt_routing.js`	New file implementing prompt mode resolution logic based on scenario, mode, action, and reason inputs
`.github/scripts/keepalive_loop.js`	Major update adding task attempt history, verification workflow support, improved error handling for skipped/cancelled runs, and integration with prompt routing
`.github/scripts/keepalive_instruction_template.js`	Refactored to support multiple template paths and dynamic template selection based on prompt mode
`.github/scripts/error_classifier.js`	Added patterns for detecting transient git workspace state issues
`.github/scripts/agents-guard.js`	Modified approval logic to allow automated PRs (dependabot, renovate) to bypass approval when they have the allow label

Copilot · 2026-01-05T07:02:38Z

.github/scripts/keepalive_instruction_template.js

+        content = fs.readFileSync(TEMPLATE_PATH, 'utf8').trim();
+      } catch (fallbackError) {
+        console.warn(
+          `Warning: Could not load keepalive instruction template from ${resolvedPath}: ${fallbackError.message}`


The warning message at line 84 displays resolvedPath in the error, but the error actually originated from trying to read TEMPLATE_PATH (the fallback). This could be confusing for debugging. Consider updating the message to clarify that both the requested path and the fallback path failed to load.

Suggested change

`Warning: Could not load keepalive instruction template from ${resolvedPath}: ${fallbackError.message}`

`Warning: Could not load keepalive instruction template. `

+ `Primary path "${resolvedPath}" failed with: ${err.message}. `

+ `Fallback path "${TEMPLATE_PATH}" also failed with: ${fallbackError.message}`

Copilot · 2026-01-05T07:02:39Z

.github/scripts/agents-guard.js

+  // Allow label to bypass approval for automated PRs (dependabot, renovate)
+  const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]');
+  const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !(hasAllowLabel && isAutomatedPR);


The logic allows automated PRs (dependabot, renovate) to bypass approval requirements if they have the allow label. However, this creates a potential security risk where an automated PR with the allow label can modify protected workflow files without human review. Consider whether this bypass should require both the label AND some form of approval, or if there should be additional constraints on what types of changes automated PRs can make to protected paths.

Suggested change

// Allow label to bypass approval for automated PRs (dependabot, renovate)

const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]');

const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !(hasAllowLabel && isAutomatedPR);

// Automated PRs (dependabot, renovate) must always get approval for protected changes,

// even if they have the allow label. The label can still bypass approval for

// human-authored PRs.

const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]');

const automatedBypassAllowed = hasAllowLabel && !isAutomatedPR;

const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !automatedBypassAllowed;

Copilot · 2026-01-05T07:02:39Z

.github/scripts/keepalive_instruction_template.js

+
+  if (agent && typeof agent === 'object') {
+    params = agent;
+    resolvedAgent = params.agent;


The function signature change for getKeepaliveInstructionWithMention makes the first parameter accept either a string (agent name) or an object (options). However, the backward compatibility logic at lines 120-123 has a potential issue: if agent is an object with a falsy agent property (e.g., { agent: '' }), the resolved agent will be falsy and fall back to 'codex', but this might not be the intended behavior. Consider explicitly checking if agent.agent exists in the object rather than just using its value.

Suggested change

resolvedAgent = params.agent;

if (Object.prototype.hasOwnProperty.call(params, 'agent')) {

resolvedAgent = params.agent;

}

Copilot · 2026-01-05T07:02:39Z

.github/scripts/error_classifier.js

  'eai_again',
+  // Git workspace state issues - agent encountered unexpected changes
+  'unexpected changes',
+  'untracked',


The pattern 'untracked' at line 46 is too generic and could match legitimate error messages about untracked files that are not transient infrastructure issues. Consider making this pattern more specific, such as 'untracked.*workflows-lib' or 'untracked.*codex-session', to avoid false positives where actual code issues involve untracked files.

Suggested change

'untracked',

'untracked.*workflows-lib',

'untracked.*codex-session',

Copilot · 2026-01-05T07:02:40Z

.github/scripts/keepalive_loop.js

  let action = 'wait';
  let reason = 'pending';
+  const verificationStatus = normalise(state?.verification?.status);
+  const verificationDone = ['done', 'verified', 'complete'].includes(verificationStatus.toLowerCase());


The verification status is normalized to lowercase at line 1091, but line 1092 calls .toLowerCase() again on verificationStatus which is already lowercase. This is redundant. The check should be ['done', 'verified', 'complete'].includes(verificationStatus) since the value has already been normalized to lowercase.

Suggested change

const verificationDone = ['done', 'verified', 'complete'].includes(verificationStatus.toLowerCase());

const verificationDone = ['done', 'verified', 'complete'].includes(verificationStatus);

chore: sync workflow templates from Workflows repo

3056bd4

Automated sync from stranske/Workflows Template hash: 69bf45f7ea5a Changes synced from sync-manifest.yml

Copilot AI review requested due to automatic review settings January 5, 2026 06:59

stranske added sync Automated sync from Workflows automated Automated sync from Workflows labels Jan 5, 2026

stranske temporarily deployed to agent-standard January 5, 2026 06:59 — with GitHub Actions Inactive

github-actions bot added the autofix Triggers autofix on PR label Jan 5, 2026

Copilot started reviewing on behalf of stranske January 5, 2026 06:59 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

stranske merged commit d1279e6 into main Jan 5, 2026
46 of 51 checks passed

stranske deleted the sync/workflows-69bf45f7ea5a branch January 5, 2026 08:44

github-actions bot mentioned this pull request Jan 5, 2026

[Follow-up] Unmet criteria from PR #147 #148

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: sync workflow templates#147

chore: sync workflow templates#147
stranske merged 1 commit intomainfrom
sync/workflows-69bf45f7ea5a

stranske commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 5, 2026

Uh oh!

Copilot AI Jan 5, 2026

Uh oh!

Copilot AI Jan 5, 2026

Uh oh!

Copilot AI Jan 5, 2026

Uh oh!

Copilot AI Jan 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-          `Warning: Could not load keepalive instruction template from ${resolvedPath}: ${fallbackError.message}`
+          `Warning: Could not load keepalive instruction template. `
+          + `Primary path "${resolvedPath}" failed with: ${err.message}. `
+          + `Fallback path "${TEMPLATE_PATH}" also failed with: ${fallbackError.message}`

-  // Allow label to bypass approval for automated PRs (dependabot, renovate)
-  const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]');
-  const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !(hasAllowLabel && isAutomatedPR);
+  // Automated PRs (dependabot, renovate) must always get approval for protected changes,
+  // even if they have the allow label. The label can still bypass approval for
+  // human-authored PRs.
+  const isAutomatedPR = normalizedAuthor && (normalizedAuthor === 'dependabot[bot]' || normalizedAuthor === 'renovate[bot]');
+  const automatedBypassAllowed = hasAllowLabel && !isAutomatedPR;
+  const needsApproval = hasProtectedChanges && !hasCodeownerApproval && !automatedBypassAllowed;

	'untracked',
	'untracked.*workflows-lib',
	'untracked.*codex-session',

	const verificationDone = ['done', 'verified', 'complete'].includes(verificationStatus.toLowerCase());
	const verificationDone = ['done', 'verified', 'complete'].includes(verificationStatus);

Conversation

stranske commented Jan 5, 2026

Sync Summary

Files Updated

Files Skipped

Review Checklist

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

github-actions bot commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Keepalive Loop Status

Current State

🔍 Failure Classification

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Jan 5, 2026 •

edited

Loading